Summary: | <sys-cluster/swift-2.15.1-r1: possible root privilege escalation via config file replacement | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Michael Orlitzky <mjo> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | openstack, prometheanfire |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | C3 [noglsa] | ||
Package list: | Runtime testing required: | --- |
Description
Michael Orlitzky
2017-08-31 13:26:02 UTC
fixed in 2017.2.9999 and 2.15.1-r1 (which is set to go stable with the rest of pike in about a month). so... let me know next steps fixed by changing the owner to root:swift and fperms 0750 on /etc/swift 2.15.1-r1 is now stable (In reply to Matthew Thode ( prometheanfire ) from comment #3) > 2.15.1-r1 is now stable Thanks Matthew, could you please verify if the tree is clean of vulnerable versions? @Security please add to an existing glsa or file a new one. Gentoo Security Padawan ChrisADR yep, cleaned up and stable (In reply to Matthew Thode ( prometheanfire ) from comment #5) > yep, cleaned up and stable Thank you Maintainer(s), please drop the vulnerable version(s). | | u | | a a p s a n r | n | | l m h i p p r m m i i s | e u s | r | p d a p a p c a x m i 6 o s 3 | a s l | e | h 6 r p 6 p 6 r 8 6 p 8 s c 9 s | p e o | p | a 4 m a 4 c 4 c 6 4 s k 2 v 0 h | i d t | o ---------------+---------------------------------+-------+------- 2.10.2-r1 | o + o o o o o o + ~ o o o o o o | 5 # 0 | gentoo 2.13.1-r1 | o + o o o o o o + ~ o o o o o o | 6 # | gentoo 2.15.1-r1 | o + o o o o o o + ~ o o o o o o | 6 o | gento the r1's are not vulnerable, the same fix was made to all released versions. GLSA Vote: No |